A variety of electronic devices apply programmable control means, such as microprocessors, microcontrollers, programmable logics, and/or application-specific programmable integrated circuits. Such electronic devices contain stored software consisting of one or more programs containing e.g. program commands required for the operation of the electronic device. In the storage of such software, a memory is used, of which at least a part is a non-volatile memory, i.e. the content of the memory is retained even if the operating voltage of the memory is cut off. Such memories include for example a read-only memory (ROM), a programmable ROM (PROM) and an electrically erasable PROM (EEPROM). At least a part of the memory is normally integrated in the electronic device, but in addition, the memory can be increased in many applications by means of, for example, a memory expansion board. One such memory expansion board is the so-called Flash memory card. The Flash memory is a kind of EEPROM type memory whose content can be changed by electrical programming. The contents of the Flash memory will be retained even after the cutting off of the operating voltages. By means of such an expansion memory, it is easy to provide the electronic device with new software, memory capacity for storing, for example, photographs in a digital camera, for setting access rights e.g. in a mobile station, etc. The installation of software in an electronic device can also be performed, in a way known as such, by using other storage means, such as a diskette, a CD-ROM, or a DVD.
It is relatively easy to copy software stored on storage means, wherein software providers have developed various methods to prevent the use of copied software. One such method is to use a product ID or the like. Thus, upon starting the program, the user must enter this product ID in the electronic device before the program can be used. However, a problem with such an arrangement is that in connection with copying of the program, the user may have obtained this product ID from the owner of the original software, and also the copied program can then be used. On the other hand, even if the user of the copied software did not know the product ID, the user may try to find out the structure of the program protection, for example by reverse engineering or debugging, wherein the object code of the program is converted to the source code. Thus, the user may succeed in decrypting the copy protection and in modifying the program, for example, in such a way that the copy protection is off, or in such a way that the user resolves the required product ID on the basis of the object code. To make such a possibility more difficult, programs have been developed, in which it is checked at intervals, during the running of the program, that the program has not been tampered with. Thus, the mere decryption of the copy protection upon the booting does not necessarily make it possible to use the copied software for a longer time, unless the user is capable of determining the structure of such copy protection.
It is known to connect a given program unequivocally to a given device in such a way that the program cannot be used in another device. This can be done, for example, by modifying the software on the basis of the hardware-specific serial number or by supplying an installation program which is only functionable in one device on the basis of the hardware-specific serial number. These solutions have the drawback that this protection can be broken up by modifying either the software or the hardware.
To aggravate debugging, an attempt can be made to complicate at least the copy protection part and/or the storage of the product ID in connection with the program code, wherein it becomes more difficult to break up the copy protection. One such solution is presented e.g. in the international patent application WO 00/77597.
The U.S. Pat. No. 5,131,091 presents a method in which a program stored on a memory card is protected by scrambling the content of the program code with XOR operations. In the scrambling, an encryption bit string stored in a non-volatile memory is used, and finding out the string has been made as difficult as possible. A different encryption bit string is used on memory cards supplied to different users.
A user who has legally acquired the software may also need to secure the origin of the software, because in some cases, a third party may attempt to supply versions modified from original programs and to market them as original programs. Such software may contain, for example, an added virus, or the software is provided with a so-called back door, through which the manufacturer of the modified software may even have access to the local area network of a firm which has installed this modified software. In some cases, the modified software is provided with the property of transmitting, for example, user identifications and passwords entered by the user in the electronic device e.g. via a data network such as the Internet to the manufacturer of the modified software, without the user noticing this. To secure the origin of the software, the program can be provided with a digital signature, on the basis of which the user can establish the authenticity of the original software.
In addition to the copy protection of programs, there is also a need to protect other information stored in connection with electronic devices, to prevent misuse. For example, the restriction of access rights to a specific user or specific users is, in connection with some electronic devices, arranged so that the user has a personal smart card, wherein, to use the electronic device, the user inserts the smart card in a card connector provided in the electronic device. As auxiliary authentication, it is also possible to use a user identification, wherein upon turning on of the electronic device, the user must enter this user identification before the electronic device can be used. Such an arrangement is applied e.g. in many mobile communication networks, such as the GSM mobile communication network and the UMTS mobile communication network. In a mobile station to be used in such a mobile communication network, a smart card is inserted, which is called a SIM (Subscriber Identity Module) in the GSM system and a USIM (Universal Subscriber Identity Module) in the UMTS system. In such a smart card, the service provider of the mobile communication network has already set certain subscriber specifications, such as the International Mobile Subscriber Identifier (IMSI). The user identification is also stored in this smart card, wherein the smart card checks the user identification when the mobile station is turned on.
However, the above-presented solutions do not solve the problem that a third party modifies the software in such a way that it can use it itself either in another device or change the operation of the program in this device. Such a problem has come up e.g. in connection with mobile stations, in which it has been possible to access the services of a mobile communication network free of charge by making a copy of a mobile station. The software and the international mobile equipment identity (IMEI) of the copied mobile station are identical with those in the original mobile station. A copy is also made of the smart card which is installed in the copied mobile station. Thus, the mobile switching centre does not distinguish between the original mobile station and the copied one.
Yet another drawback in the prior art encryption solutions of software and other data is that if the same encryption key is used for encrypting large quantities of information, the decryption of the encryption key may be successful by analyzing such encrypted information.
With an increase in the data processing capabilities of portable devices, more information can be stored in them, which may also be confidential or otherwise such information that must not be revealed to an outsider. The carrying of portable devices will, however, increase the risk that the portable device is lost or stolen, wherein an attempt must be made to protect the information stored in it with an encryption method. For portable devices, it is normally possible to determine a password which the user must enter in the device at the stage of turning on, until the device can be normally used. However, such a protection is relatively easy to pass, because the passwords used are normally relatively short, typically having a length of less than ten characters. On the other hand, even if no attempt were made to find out the password, the information contained in the device can be accessed, for example, by transferring the storage means, such as a fixed disk, into another device. If the information contained in the storage means is not in encrypted format, the information stored in the storage means can be easily found out.
It is known that information needed by the user or the device can be encrypted with one key, the encrypted information can be stored in the memory of the device, and it can be decrypted with another key. The key used in asymmetric encryption is different from the key used in decryption. Correspondingly, the key used in symmetric encryption is the same as the key used in decryption. In asymmetric encryption, these keys are normally called a public key and a personal key. The public key is intended for encryption and the personal key is intended for decryption. Although the public key may be commonly known, it can normally not be used to easily determine the personal key corresponding to the public key, wherein it is very difficult for an outsider to find out information encrypted with this public key. One example of a system based on the use of such a public key and a personal key is the PGP system (Pretty Good Privacy), in which the user encrypts the information to be transmitted with the public key of the receiver, and the receiver will then open the encrypted information with his/her personal key. However, there are considerable drawbacks in the systems of prior art. Effective symmetric keys consist of about 100 bits, whereas asymmetric keys consist of about 1000 to 2000 or even up to 4000 bits. If the key string is too short, it is relatively easy to break up with modern data processing equipment which has been called the brute force attack. This problem is particularly significant in portable data processing and communicating devices, in which also the limited processing capacity prevents the use of long keys.